---
- name: ➕ Add /var/www/discourse to Git safe.directory
  ansible.builtin.shell: > # nocheck: container-exec-resolver  discourse is a launcher-managed container named literally in both modes
    container exec {{ WORDPRESS_DISCOURSE_CONTAINER_ADDRESS }}
    git config --global --add safe.directory /var/www/discourse
  changed_when: false

- name: 🚫 Revoke old WP Discourse API keys via Rails
  ansible.builtin.command:
    argv:
      - container
      - exec
      - -i
      - "{{ WORDPRESS_DISCOURSE_CONTAINER_ADDRESS }}" # nocheck: container-exec-resolver  discourse is a launcher-managed container named literally in both modes
      - bash
      - -lc
      - "cd /var/www/discourse && script/rails runner -"
    stdin: "{{ lookup('file', 'ruby/revoke_wp_discourse_api_keys.rb') }}"
  changed_when: false
  failed_when: false

- name: ⚙️ Generate new WP Discourse API key via Rake task
  ansible.builtin.shell: > # nocheck: container-exec-resolver  discourse is a launcher-managed container named literally in both modes
    container exec {{ WORDPRESS_DISCOURSE_CONTAINER_ADDRESS }}
    bash -lc "cd /var/www/discourse && bin/rake api_key:create_master['WP Discourse Integration']"
  register: discourse_generated_api_key

- name: 💾 Store the new WP Discourse API key in a fact
  no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
  set_fact:
    vault_discourse_api_key: "{{ discourse_generated_api_key.stdout | trim }}"